x/vulndb: potential Go vuln in github.com/rancher/rancher/server: GHSA-xhg2-rvm8-w2jh

[julieqiu]

In GitHub Security Advisory GHSA-xhg2-rvm8-w2jh, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/rancher/rancher/server	2.2.5	>= 2.2.0, < 2.2.5

See doc/triage.md for instructions on how to triage this report.

packages:
  - package: github.com/rancher/rancher/server
    versions:
      - introduced: 2.2.0
        fixed: 2.2.5
  - package: github.com/rancher/rancher/server
    versions:
      - introduced: 2.1.0
        fixed: 2.1.11
  - package: github.com/rancher/rancher/server
    versions:
      - introduced: 2.0.0
        fixed: 2.0.16
description: Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking
    attack that allows an exploiter to gain access to clusters managed by Rancher.
    The attack requires a victim to be logged into a Rancher server, and then to access
    a third-party site hosted by the exploiter. Once that is accomplished, the exploiter
    is able to execute commands against the cluster's Kubernetes API with the permissions
    and identity of the victim.
published: 2021-05-18T15:42:40Z
last_modified: 2022-04-25T20:20:19Z
cves:
  - CVE-2019-13209
ghsas:
  - GHSA-xhg2-rvm8-w2jh
links:
    context:
      - https://github.com/advisories/GHSA-xhg2-rvm8-w2jh

[gopherbot]

Change https://go.dev/cl/421055 mentions this issue: x/vulndb: add reports/GO-2022-0755.yaml for CVE-2019-13209